security: restrict model lifecycle endpoints to admins

[2024itb047samata]

What changed

• Secured model lifecycle endpoints using _require_admin_access()
• Added a dedicated backend/auth.py authorization helper
• Restricted model building and weight mutation operations to authenticated administrators only
• Prevented unauthorized retraining and production model manipulation

Protected endpoints

• /api/build
• /api/weights

Why

Previously, model lifecycle endpoints were publicly callable without administrative authorization. This created a critical integrity and availability vulnerability where attackers could:

• trigger expensive retraining jobs
• exhaust CPU and memory resources
• manipulate recommendation weights
• degrade recommendation quality
• mutate production recommender behavior

This fix ensures only authorized administrators can perform model training and tuning operations.

How to test

# Start backend server
python -m uvicorn backend.main:app --reload

Unauthorized request:

Invoke-WebRequest `
-Uri "http://127.0.0.1:8000/api/build" `
-Method POST

Expected response:

{"detail":"Admin access required."}

Test weights endpoint:

Invoke-WebRequest `
-Uri "http://127.0.0.1:8000/api/weights" `
-Method PUT

Expected:

• 403 Forbidden
• unauthorized access blocked successfully

Checklist

• I have read the [[CONTRIBUTING.md]
• My code follows PEP8 style (flake8 .)
• I have tested my changes locally
• I have added/updated tests where applicable
• I can explain every line of code I've written
• I have NOT used AI-generated code without understanding and attributing it

Related issue

Closes #642

AI assistance disclosure

• I used AI assistance for:

  • understanding FastAPI authorization patterns
  • reviewing security implications of public model lifecycle endpoints
  • implementing admin authorization checks
  • improving PR documentation wording

[github-actions]

🎉 Welcome to Hybrid Recommender, @2024itb047samata! This is your first contribution here!

Labels added: gssoc:approved | mentor:leonagoel | status:review-needed

PR Description Checklist:

YES - What changed section
YES - Why section
YES - How to test section
YES - Related issue linked

✅ PR description looks complete!

What happens next:

1. @leonagoel will review your changes
2. CI checks must pass
3. Once approved, this PR will be auto-merged

⏱️ Please respond to review comments within 48 hours.

[github-actions]

⚠️ Main branch was just updated!

PR #595 ("Feat: Add personalized user recommendation endpoint with cold-start fallback") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #608 ("Fix startup indentation error") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #610 ("Fix/duplicate domcontentloaded init") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #612 ("Fix/prevent xss category rendering") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #613 ("feat: add diversity and serendipity controls to prevent filter bubble…") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #614 ("perf: precompute top-N recommendations and serve cache from Redis") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #616 ("feat: implement knowledge graph embeddings for semantic item relationships") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #626 ("test: add unit tests for HybridWeightsSchema and ModelHyperparameters…") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #628 ("Fix/admin auth model routes") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #630 ("Fix/GitHub webhook fail closed") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #631 ("Refactor upload validation logic in main.py") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #633 ("Fix/feedback persistence") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #634 ("Add new dependencies to requirements.txt") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #636 ("Refactor forward methods to use standard definition") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #637 ("Fix/rate limit feedback webhook") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #638 ("Refactor forward methods in UserTower and ItemTower") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #647 ("fix(content-model): resolve IndentationError and limit search candidates to top_n") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #649 ("fix(hybrid-model): add missing model_kwargs parameter to constructor") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #651 ("fix(api): add missing request parameter to get_recommendations") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1624 ("feat: Celery task progress tracking and webhook notifications (Issue #1577)") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1625 ("feat: GNN RGCN integration scaffold with knowledge-graph dataset path (Issue #1576)") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1626 ("feat: add A/B testing framework for recommendation algorithm variants…") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1632 ("Add a title * Fix/popularity boost score cap Add a description Comment") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1040 ("fixed: Duplicate PR template files cause Git conflicts on case-insens…") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1527 ("fix(model): fix IndentationError in select_bandit_arm and unindented bandit arm weight assignment") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1633 ("fix: Duplicate results-processing loop removed from search_items(#1631)") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1640 ("fix: resolve hybrid_model merge conflicts and add explanation string") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1641 ("Fix/svd memory leak") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1642 ("Feature/evaluation dashboard") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1643 ("Feature/streamlit tfidf config") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1644 ("Fix/strict csrf origin validation") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1645 ("Feature/svd online updating") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1647 ("fix: add title query param endpoint to resolve HTTP 422 (#1075)") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1648 ("fix(federated): prevent regularization decay in aggregate_updates") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1650 ("fix: remove duplicate code block in hybrid_model.py causing Indentati…") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1653 ("fix: remove duplicate /api/recommend route") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1654 ("build: add faiss dependency for two-tower retrieval") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1655 ("fix: enforce stronger signup password validation") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1660 ("security: reject unissued csrf tokens") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1661 ("feat: add KNN-based user collaborative filtering (Issue #51)") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1665 ("fix: add missing faiss-cpu dependency to requirements.txt ") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1515 ("feat: harden realtime recommendation WebSocket flow") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1668 ("fix(ci): resolve syntax and indentation errors breaking upstream main") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1669 ("feat(rate-limit): implement Token Bucket algorithm for rate-limiting middleware for search API protection") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1675 ("fix: IDOR vulnerability on purchases endpoints (#294)") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1676 ("docs: add required Supabase initialization steps to Docker setup guide") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1677 ("fix: implement background cache cleanup to prevent OOM") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1678 ("feat: add recommendation feedback loop support") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀

[github-actions]

⚠️ Main branch was just updated!

PR #1679 ("fix: use gin_trgm_ops for GIN trigram index") was just merged into main.

Please rebase your branch to avoid conflicts:

git fetch origin
git rebase origin/main
git push --force-with-lease

Keeping your branch up to date prevents merge conflicts. 🚀